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and 3 7 have been amended and not narrowed. Claims 1-3 9 are pending 
in the application. Attached hereto is a marked-up version of the 
changes made to the above-identified application by the current 
amendment. The attached page is captioned " Version with markings to 
show changes made . " 

On page 2 of the Action, claims 1-8, 14-19, 28-32 and 34-36 are 
rejected under 35 U.S.C. 103(a) as being unpatentable over U.S. Patent 
No. 6,144,962 issued to de la Salle in view of U.S. Patent no. 
5,485,455 issued to Dobbins et al . ("Dobbins"). This rejection is 
respectfully traversed. 

Claim 1 recites a network interface device configured to non- 
intrusively measure network traffic transferred in and out of an 
intranet for at least one connection. Claim 14 also recites that a 
metrics generator is configured to non- intrusively measure network 
traffic being transferred in and out of the at least one server and 
to generate performance metrics from the network traffic measured. 
Claim 17 recites that a first metrics server inside the intranet is 
configured to non- intrusively measure network traffic being 
transferred in and out of the intranet and to generate performance 
metrics based on the network traffic measured. Claim 28 recites non- 
intrusively measuring network traffic between at least one server in 
an intranet and at least one client outside the intranet. Claim 34 
also recites non- intrusively measuring network traffic for at least 
one connection, the at least one connection being a logical path 
between at least one server inside an intranet and at least one client 
outside the intranet. Claims 1, 14, 17, 28 and 34, as amended, also 
recite that an intranet is a network accessible only by authorized 
users . 

The Action on page 2 suggests that de la Salle describes a 
separate intranet for a server communicating to clients external to 
that intranet (FIG. 1) . However, de la Salle, at most, describes, in 
col. 6, lines 6-11, in reference to FIG. 1, that a computer network 
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12 is shown to be an overall array which includes a number of 
discretely identifiable branch arrays, referred to for simplicity as 
LAN 14, although it is recognized that each of the branches may not 
fit the classic definition of a local area network, since each does 
not include a server component." As such, de la Salle does .not 
describe or suggest an intranet, i.e., a network accessible only by 
users with authorization. Thus, de la Salle also does not describe 
or suggest measuring network traffic transferred in and out of the 
intranet or in and out of a server or metrics server in the intranet, 
or measuring network traffic between a server inside the intranet and 
a client outside the intranet, as recited in claims 1, 14, 17, 28 and 
34. 

Dobbins also describes, in col. 13, lines 41-60 in reference to 
FIG. 4, an "illustration of a networking chassis adapted to 
incorporate the SFPS technology. As shown, the chassis 30 is a 
mechanical enclosure 31 which is used to house a plurality of 
networking modules 32, which may include repeater modules, bridge 
modules, router modules, terminal servers, file servers, etc. The 
chassis or hub in a mostly connection of diverse LAN segments, 
including internet, token ring and FDD I segments, as well as to wide 
area networks (WANS)." As such, Dobbins also does not describe or 
suggest an intranet and thus does not describe or suggest measuring 
network traffic transferred in and out of the intranet or in and out 
of a server or metrics server in the intranet, or measuring network 
traffic between a server inside the intranet and a client outside the 
intranet, as recited in claims 1, 14, 17, 28 and 34. Accordingly, 
claims 1, 14, 17, 2 8 and 34 are believed to be patentable. 

Therefore, since claims 2-8 depend from claim 1 and contain 
additional limitations that are patentably distinguishable over the 
references of record, claims 2-8 are also believed to be patentable. 
Also, since claims 15-16 depend from claim 14 and contain additional 
limitations that are patentably distinguishable over the references 
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of record, claims 15-16 are also believed to be patentable. 
Furthermore, since claims 18-19 depend from claim 17 and contain 
additional limitations that are patentably distinguishable over the 
references of record, claims 18-19 are believed to be patentable. 
Moreover, since claims 29-32 depend from claim 28 and contain 
additional limitations that are patentably distinguishable over the 
references of record, claims 29-32 are believed to be patentable. 
Also, since claims 35-36 depend from claim 34 and contain additional 
limitations that are patentably distinguishable over the references 
of record, claims 35-36 are believed to be patentable. 

Claim 2 also recites that the at least one connection is 
delimited by a last packet from the specific source to the specific 
destination. The Action on page 3, indicates that de la Salle 
teaches "a first packet being transmitted between two nodes as a data 
segment is detected between the two nodes and an end to the data 
stream is detected by a lack of packets or after a last packet (col. 
18, lines 14-28) ." 

However, de la Salle and Dobbins do not describe or suggest that 
a last packet from the specific source to the specific destination 
delimits the connection. De la Salle does describe, in col. 18, 
lines 25-26 and as noted in the Action, that the end of the 
transaction is determined in response to detecting an absence of 
successive ones of data packets. However, de la Salle and Dobbins do 
not describe or suggest that a last packet (rather than an absence of 
a packet) delimits the connection and the last packet is from a 
specific source to the specific destination. Accordingly, even if 
there is a motivation to combine de la Salle and Dobbins, the 
references combined do not arrive at the invention as recited in claim 
2 and thus claim 2 is believed to be patentable. 

Claim 3 also recites that the specific source is identified by 
a source Internet Protocol address in the first packet and the 
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specific destination is identified by a destination Internet Protocol 
address in the first packet. 

The Action indicates, on page 3, that "de la Salle teaches in IBM 
compatible computer or various subnetworks as types of networks 
developed for the configuration described herein; however, de la Salle 
fails to teach IP addresses assigned to the server and client as 
references for the source and destination addresses used to identify 
the respective nodes of the network, the Examiner takes official 
notice that an IP address is well known as a means to identify a node 
on a network especially within IBM compatible computers and related 
subnetworks." However, in the absence of specific evidence that a 
first packet for a connection has a source internet protocol address 
and a destination internet protocol address to identify respectively 
the source and destination would be obvious to a person of ordinary 
skill in the art, the rejection based on "general knowledge" or 
"common sense" is improper. See In re Lee, 61 U.S. P. Q. 2d 1430, 1435 
(Fed. Cir. 2002) . Instead, the action must articulate, and place on 
the record, any knowledge to which it refers. Id. 

Here, the Action also simply takes Official notice that it is 
well known that an IP address is well known as a means to identify a 
node on a network especially within IBM compatible computers and 
related subnetworks. However, the Action fails to cite any objective 
evidence that such knowledge actually exists. Furthermore, the Action 
fails to meet the obligation to show that the first packet for a 
connection having a source internet protocol address and a destination 
internet protocol address to identify respectively the source and 
destination would have been obvious to a person with ordinary skill 
in the art. Id. For these reasons, Applicants respectfully request 
withdrawal of the rejection or requests the reference that supports 
the Action's position and in particular the reference that describes 
that a first packet for the connection has a source internet protocol 
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address and a destination internet protocol address to identify- 
respectively the source and destination. 

Claim 8, as amended, recites that an active connection table 
contains entries for a connection that is active during a 
predetermined measurement time interval and an entry is deleted from 
memory when the at least one connection for the entry is inactive when 
the predetermined measurement time interval expires. 

The Action, on page 4, indicates that u de la Salle teaches server 
32 acting as a router for calculating hop counts, the Examiner takes 
official notice that the most basic needs of a router are memory for 
routing table storage and data forwarding and a network interface." 
However, de la Salle does not describe or suggest an active connection 
table with entries for connections that are active during a 
measurement time interval and thus de la Salle does not teach or 
suggest an active connection table being stored in memory. De la 
Salle also does not describe or suggest that an entry is deleted from 
memory when the at least one connection for the entry is inactive when 
the predetermined measurement time interval expires. Accordingly, 
even if there is a motivation to combine the references, claim 3 is 
believed to be patentable. 

Furthermore, in the absence of specific evidence that an active 
connection table with entries for connections that are active during 
a measurement time interval and storing the active connection table 
in memory would be obvious to a person of ordinary skill in the art, 
the rejection based on "general knowledge" or "common sense" is 
improper. See In re Lee, 61 U.S.P.Q. 2d 1430, 1435 (Fed. Cir. 2002) . 
Instead, the action must articulate, and place on the record, any 
knowledge to which it refers. Id. Here, the Action also simply takes 
Official notice that it is well known that most basic needs of a 
router are memory for routing table storage and data forwarding and 
a network interface. However, the Action fails to cite any objective 
evidence that such knowledge actually exists. Furthermore, the Action 
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fails to meet the obligation to show that an active connection table 
with entries for connections that are active during a measurement time 
interval and storing the active connection table in memory would have 
been obvious to a person with ordinary skill in the art. Id. For 
these reasons, Applicants respectfully request withdrawal of the 
rejection or requests the reference that supports the Action's 
position and in particular the reference that describes an active 
connection table with entries for connections that are active during 
a measurement time interval and storing the active connection table 
in memory. 

Claim 31 recites that network traffic is intrusively measured 
between a server and a client in an intranet. Claim 32 also recites 
that the intrusive measurement of network traffic includes injecting 
and monitoring probing packets that are transferred between the at 
least one server and the at least one client outside the intranet. 
Claim 36 also recites intrusively measuring network traffic for the 
at least one connection. 

As noted above in reference to claim 1, de la Salle and Dobbins 
do not describe or suggest an intranet, i.e., a network accessible 
only by users with authorization. Thus, even if there is a motivation 
to combine the references, de la Salle and/or Dobbins also does not 
describe or suggest intrusively measuring network traffic between a 
server and a client in an intranet or injecting and monitoring probing 
packets that are transferred between a server and a client outside the 
intranet . 

Additionally, regarding claim 32, the Action on page 4 indicates 
that "de la Salle teaches: a probe computer that probes the network 
(FIG. 2) but fails to teach of intrusive or probing packets being 
added to the regular flow of data in a respective network. Dobbins 
teaches: a probe packet used on a connection establishment 
determination network arrangement. Therefore it would have been 
obvious to one of ordinary skill in the art at the time the invention 
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was made to have combined the use of probe packets on a network as an 
effective means to track packets on a network." However, Dobbins at 
most describes, in col. 16, lines 30-35, that "if the broadcast frame 
was a probe or address resolution packet (i.e., an implied connect 
request) , the call processor will return a probe reply as a "proxy" 
which gives the destination end system MAC addresses. Subsequently, 
the source end system can then send packets directly to the 
destination based on its MAC address." Thus, Dobbins describes a 
probe packet to receive a return probe reply to give the destination 
end system and not monitoring and injecting probing packets for 
intrusively measuring network traffic. Accordingly, even if there is 
a motivation to combine the references, Dobbins and/or de la Salle do 
not describe or suggest monitoring and injecting probing packets for 
intrusively measuring network traffic. 

Furthermore, there is no motivation to combine de la Salle and 
Dobbins to arrive at the Applicants' invention as recited in claims 
31-32 and 36. In fact, de la Salle describes in col. 4, lines 61-63 
that "an advantage of the present invention is that it can act in a 
"passive" mode, without sending out frequent query messages which only 
add traffic onto a network" and in the Abstract, a "system (10) is 
used to measure a transaction response time of a transaction on a 
distributed application in a way which is non- intrusive to the 
application by examining data packets for the presence or absence of 
session layer data." Thus, neither de la Salle or Dobbins provide a 
motivation to combine with the other to provide a method comprising 
non- intrusive and intrusive measuring of network traffic as provided 
in claims 31-32 and 36. Accordingly, claims 31-32 and 36 are believed 
to be patentable. 

Also, on page 4 of the Action, claims 9-11 and 37-39 are rejected 
under 35 U.S.C. 103(a) as being unpatentable over de la Salle in view 
of Dobbins in further view of U.S. Patent No. 5,375,070 issued to 
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Hershey et al . ("Hershey"). This rejection is respectfully 
traversed. 

As noted above, claim 1 is believed to be patentable and since 
claims 9-11 depend from claim 1 and contain additional limitations 
that are patentably distinguishable over the references of record, 
claims 9-11 are also believed to be patentable. 

Claim 9 also recites that a processor updates an active 
connection table based on a measured network traffic and a 
predetermined measurement time interval. As noted previously, in 
reference to claim 8, neither de la Salle or Dobbins describe an 
active connection table with entries for a connection that is active 
during a predetermined measurement time interval. 

Hershey does describe, in col. 5, lines 19-25 and in FIG. 1A, 
that a "router 115 uses a routing table contained therein to establish 
a logical and/or physical connection between one of the senders Al, 
A2 or A3 and one of the destinations Bl, B2 or B3 . The routing table 
shown in FIG. 1A illustrates that the source Al is connection to the 
destination Bl over the path P2 which is the FDDI network 126." 
Hershey further describes, in col. 5, lines 53-57, that the "router 
115, in response, will revise its routing table so as to connect the 
sender A2 to the destination B2 over a different network providing a 
more optimal communication than that currently provided by the token 
ring LAN 124." However, Hershey does not describe or suggest updating 
the table based on measured network traffic and the predetermined 
measurement time interval or a processor configured to do the 
updating, as recited in claim 9. Accordingly, even if there is any 
motivation to combine de la Salle, Dobbins and Hershey, the references 
combined do not arrive at the invention as claimed in claim 9 and thus 
claims 9 is believed to be patentable. 

Claim 11 recites that the generation of performance metrics 
includes the determination of source and destination Internet Protocol 
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addresses and timestamp information of the packets captured within the 
predetermined measurement time interval. 

The Action on page 5 indicate that "Hershey teaches: a network 
with a time stamp as a means for tracing data for a time dependent 
network (col. 1, lines 40-46) and a data processor 105 coupled to 
memory 100 and a table for storage of source and destination 
information." Hershey does describe, in col. 1, lines 40-46, that the 
"term "trace" refers to a record of all frames and bytes transmitted 
on a network, as well as environmental information. Two examples of 
environmental information include time stamps and control block 
information. A trace usually provides a complete picture of time 
dependent network behavior." Thus, although Hershey does describe 
environmental information including time stamps, Hershey does not 
describe or suggest how the time stamps are determined and more 
specifically that performance metrics with time stamp information of 
packets captured within a predetermined measurement time interval are 
generated, as recited in claim 11. Accordingly, even if there is any 
motivation to combine de la Salle, Dobbins and Hershey, the references 
combined do not arrive at the invention as claimed in claim 11 and 
thus claims 11 is believed to be patentable. 

Claim 37, as amended, recites examining packets being transferred 
during a plurality of connections, such that each connection is a 
logical path between a server in the intranet and a client outside the 
intranet. As noted previously, de la Salle, Dobbins and Hershey do 
not describe or suggest an intranet and thus also do not describe or 
suggest the server in an intranet and a client outside the intranet 
or a logical path between a server in the intranet and a client 
outside the intranet and thus neither of the references describe or 
suggest examining packets transferred during the connection between 
the server in the intranet and a client outside the intranet. 

Claim 37 also recites that performance metrics are generated from 
the examined packets for the connections upon the expiration of a 
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predetermined measurement time interval and deleting each created 
record corresponding to each connection of the plurality of 
connections that becomes inactive when the predetermined measurement 
time interval expires. The Action, on pages 5-6, indicates that de 
la Salle fails to teach of any plurality of metrics being measured by 
a server and a processor coupled to a network interface or a record 
adding a deletion method dependent upon data metrics. The Action 
further indicates on page 6 that "Dobbins teaches: a network with a 
processor coupled to a network interface (FIG. 5) and metrics measured 
and calculated throughout the system to establish traffic routing 
assistance providing a better efficiency (col. 4, lines 20-40). 
Hershey teaches: a network routing system with a routing table 
interfaced with network interfaces of memory 100 and processing unit 
105 (Figure 1A) updated periodically depending on the source or 
destination packets received therein. Therefore it would have been 
obvious to one of ordinary skill in the art at the time the invention 
was made to have combined a processor and metrics calculation with a 
server and client type network using non-intrusive techniques with a 
dynamic record keeping unit to further, increase efficiency and 
maintain accurate records of neighboring devices." 

In col. 4, lines 20-40, Dobbins does describe that an "important 
aspect of the invention is a method of determining a path between two 
nodes (end systems) on the network which has the following properties: 
the path is optimal for one metric and passes a set of threshold tests 
for a number of other metrics; and, it must do so with a given time 
constraint." Hershey, in col. 5, lines 19-23, also describes that a 
"router 115 uses a routing table contained therein to establish a 
logical and/or physical connection between one of the senders, Al, A2 
or A3 and one of the destinations Bl, B2 or B3 n and further describes 
in col. 5, lines 53-57, that the "router 115, in response, will revise 
its routing table so as to connect the sender A2 to the destination 
B2 over a different network providing a more optimal communication 
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than that currently provided by the token ring LAN 124." However, the 
references do not describe generating performance metrics from the 
examined packets for the connections upon the expiration of a 
predetermined measurement time interval. The references also do not 
teach or suggest deleting records corresponding to connections that 
become inactive beyond a measurement time interval. Accordingly, even 
if there is any motivation to combine de la Salle, Dobbins and 
Hershey, the references combined do not arrive at the invention as 
claimed in claim 37 and thus claim 37 is believed to be patentable. 

Claim 38 also recites that upon the expiration of a predetermined 
measurement time interval performance metrics that were accumulated 
and generated are distributed. The action on pages 5-6 does not 
provide any reference to de la Salle, Dobbins and/or Hershey that the 
references describe distributing the performance metrics and in 
particular distributing the performance metrics upon the expiration 
of a predetermined measurement time interval as recited in claim 38. 
However, the references do not describe or suggest distributing the 
performance metrics and in particular distributing the performance 
metrics upon the expiration of a predetermined measurement time 
interval as recited in claim 38. Accordingly, even if there is a 
motivation to combine the references, the reference combined do not 
arrive at the invention as recited in claim 38 and thus claim 38 is 
believed to be patentable. 

Claim 3 9 recites continuing to examine packets and generate, 
accumulate and distribute performance metrics for a plurality of 
successive predetermined measurement time intervals. As noted above, 
in reference to claim 38, the action on pages 5-6 does not provide any 
reference to de la Salle, Dobbins and/or Hershey that the references 
describe continuing to examine packets and generate, accumulate and 
distribute performance metrics for a plurality of successive 
predetermined measurement time intervals and in particular continuing 
to distribute performance metrics for a plurality of successive 



-23- 



Application No. 09/440,148 

predetermined measurement time intervals as recited in claim 39. 
Also, the references do not describe or suggest continuing to 
generate, accumulate and distribute performance metrics for a 
plurality of successive measurement time intervals as recited in claim 
39. Accordingly, even if there is a motivation to combine the 
references, the reference combined do not arrive at the invention as 
recited in claim 39 and thus claim 39 is believed to be patentable. 

Also, since claims 38-39 depend from claim 37 (which is believed 
to be patentable) and contain additional limitations that are 
patentably distinguishable over the references of record, claims 38-39 
are also believed to be patentable. 

On page 6 of the Action, claims 20-24, 26 and 33 are rejected 
under 35 U.S.C. 103(a) as being unpatentable over de la Salle in view 
of Dobbins and further in view of U.S. Patent No. 5,963,54 0 issued to 
Bhaskaran. Applicants respectfully traverse this rejection. 

Claim 20 recites a second metrics server that is configured to 
non- intrusively measured network traffic being transferred in and out 
of the intranet and to generate performance metrics based on. the 
network traffic measured. As noted previously in reference to claim 
1, the references, de la Salle and Dobbins, do not teach or suggest 
an intranet and thus non- intrusively measuring network traffic in and 
out of the intranet and thus de la Salle and Dobbins do not describe 
or suggest the second metrics server non- intrusively measuring network 
traffic in and out of an intranet. 

The Action also indicates on page 7 that Bhaskaran "teaches: 
conventional network with two servers (FIG. 1) with network links 
between the two servers on an IP network (col. 1, lines 15-24). 
Therefore it would have been obvious to one of ordinary skill in the 
art at the time the invention was made to have combined the 
conventional network configuration of two servers with the above 
embodiment in order to establish a conventional topological 
configuration for providing added services for flexible enhancement 
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purposes." However, Bhaskaran also does not describe or suggest non- 
intrusively measuring network traffic being transferred in and out of 
an intranet. Therefore, Bhaskaran also does not describe or suggest 
a second metrics server non- intrusively measuring network traffic as 
recited in claim 20. Accordingly, even if there is any motivation to 
combine de la Salle, Dobbins and Bhaskaran, the references combined 
do not arrive at the invention as claimed in claim 2 0 and thus claim 
20 is believed to be patentable. 

Claim 23 recites that a first metric server distributes 
performance metrics generated by the first metric server to the second 
metric server in the intranet. Claim 24 also recites that the second 
metric server distributes its performance metrics generated by the 
second metric server to the first metrics server in the intranet. 
Claim 33 also recites distributing performance metrics generated by 
the at least one server to another at least one server inside the 
intranet. Bhaskaran does describe, in col. 1, lines 15-24 and FIG. 
1, a network with a first server connected to a router and a second 
server connected to the router. However, Bhaskaran does not describe 
or suggest that the first or second server is configured to distribute 
performance metrics generated by each server to the other respective 
server in the intranet. Furthermore, the references do not provide 
a reason or motivation for distributing the performance metrics 
generated by each server to be supplied to the respective other server 
in the intranet as recited in claims 23-24 and 33. Accordingly, even 
if there is any motivation to combine de la Salle, Dobbins and 
Bhaskaran, the references combined do not arrive at the invention as 
claimed in claim 23-24 and 33 and thus claims 23-24 and 33 are 
believed to be patentable. 

Also, since claims 20-24 depend from independent claim 17, which 
as noted previously is believed to be patentable, and thus claims 20- 
24 include all the features recited in claim 17, claims 20-24 are also 
believed to be patentable. Furthermore, since claim 33 depends from 
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claim 28, which as noted previously is believed to be patentable, and 
thus claim 33 includes all the features recited in claim 28, claim 33 
is also believed to be patentable. 

Claim 26 also recites that performance metrics generated by the 
first and second metric servers are distributed on a predetermined 
periodic basis. The Action indicates on page 7 that de la Salle 
"teaches all the embodiments except a second server, while it was 
shown that it would have been obvious to combine a second server with 
a configuration taught by the applicant, it was not taught that the 
servers would periodically exchange metrics data, the Examiner takes 
official notice that it is well known in the art to a Microsoft 
certified systems engineer or related network training that a second 
server will communicate with a primary server periodically to gather 
whatever predefined metrics are administered currently by the primary 
server. " 

However, in the absence of specific evidence that distributing 
performance metrics generated by the first and second metrics server 
on a predetermined periodic basis would be obvious to a person of 
ordinary skill in the art, the rejection based on "general knowledge" 
or "common sense" is improper. See In re Lee, 61 U.S.P.Q. 2d 1430, 
1435 (Fed. Cir. 2002) . Instead, the action must articulate, and place 
on the record, any knowledge to which it refers. Jd. Here, the 
Action also simply takes Official notice that it is well known that 
a second server will communicate with a primary server periodically 
to gather whatever predefined metrics are administered currently by 
the primary server. However, the Action fails to cite any objective 
evidence that such knowledge actually exists. Additionally, the 
Action fails to meet the obligation to show that distributing 
performance metrics generated by the first and second metrics server 
on a predetermined periodic basis would have been obvious to a person 
with ordinary skill in the art. Jd. For these reasons, Applicants 
respectfully request withdrawal of the rejection or requests the 
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reference that supports the Action's position and in particular the 
reference that describes distributing performance metrics generated 
by the first and second metrics server on a predetermined periodic 
basis . 

On page 8 of the Action, the Applicants acknowledge with 
appreciation that claims 12-13, 25 and 27 would be allowable if 
rewritten to include all of the limitations of the base claim and any 
intervening claims. Accordingly, claims 12, 25 and 27 have been 
amended to include the respective base claims and intervening claims 
and not narrowed. Claim 13 depends from the now independent and 
allowable claim 12. Therefore, claim 13 is believed to be patentable. 

In view of the foregoing amendments and remarks, Applicants 
respectfully request reconsideration of the application and allowance 
of claims 1-39. If the Examiner believes that a telephone conference 
with the Applicant's attorney might expedite prosecution of the 
application, the Examiner is invited to call at the telephone number 
indicated below. 



Respectfully submitted, 



CHRISTIE, PARKER & HALE, LLP 




Patrick Y. Ikehara 
Reg. No. 42,681 
626/795-9900 



PYl/rmw 
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VERSION WITH MARKINGS TO SHOW CHANGES MADE 

1. (Amended) A metrics server in an intranet comprising: 
a network interface device configured to non-intrusively measure 
network traffic transferred in and out of an intranet for at least one 
connection, the at least one connection being a logical path from a 
specific source to a specific destination , the intranet being a 
network accessible only by authorized users ; and 

a processor coupled to the network interface device and 
configured to generate performance metrics for a predetermined 
measurement time interval using the measured network traffic for the 
at least one connection. 

8. (Amended) The metrics server of claim 7 wherein the memory 
further stores an active connection table containing entries for the 
at least one connection that is active during the predetermined 
measurement time interval and an entry is deleted from memory when the 
at least one connection for the entry is inactive when the 
predetermined measurement time interval expires . 

12 . (Amended) [ The ] A metrics server in an intranet [ of claim 
±±] comprising : 

a network interface device configured to non-intrusively measure 
network traffic transferred in and out of an intranet for at least one 
connection, the at least one connection being a logical path from a 
specific source to a specific destination; 

a processor coupled to the network interface device and 
configured to generate performance metrics for a predetermined 
measurement time interval using the measured network traffic for the 
at least one connection; 

wherein the at least one connection is delimited by a first 
packet from the specific source to the specific destination and a last 
packet from the specific source to the specific destination; 
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wherein the specific source is identified by a source Internet 
Protocol address in the first packet and the specific destination is 
identified by ■ a destination Internet Protocol address in the first 
packet for the at least one connection; 

wherein the specific source is the metrics server and the 
specific destination is at least one client outside the intranet and 
the measured network traffic includes packets being transferred 
between the metrics server and the at least one client; 

wherein the network interface device is further configured to 
filter the measured network traffic such that only header information 
contained within the packets being transferred are captured by the 
network interface device; 

a memory coupled to the network interface device and the memory 
stores the measured network traffic; 

wherein the memory further stores an active connection table 
containing entries for the at least one connection that is active 
during the predetermined measurement time interval; 

wherein the processor is further configured to update the active 
connection table based on the measured network traffic and the 
predetermined measurement time interval; 

wherein the processor is further configured to accumulate the 
performance metrics generated for the at least one connection that 
extends pass the predetermined measurement time interval; 

wherein the processor configured to generate performance metrics 
includes the determination of source and destination Internet Protocol 
addresses and timestamp information of the packets captured within the 
predetermined measurement time interval; and 

wherein the predetermined measurement time interval is one 
minute . 

14. (Amended) A measurement infrastructure comprising: 
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a plurality of clients outside an intranet , the intranet being 
a network accessible only by authorized users ; 

at least one server inside the intranet coupled to the plurality 
of clients outside the intranet; and 

a metrics generator coupled to the at least one server, the 
metrics generator is configured to non- intrusively measure network 
traffic being transferred in and out of the at least one server and 
to generate performance metrics from the network traffic measured. 

17. (Amended) A measurement infrastructure comprising: 
a plurality of clients outside an intranet , the intranet being 
a network accessible only by authorized users ; and 

a first metrics server inside the intranet coupled to the 
plurality of clients and configured to non- intrusively measure network 
traffic being transferred in and out of the intranet and to generate 
performance metrics based on the network traffic measured. 

25. (Amended) [The ] A measurement infrastructure [ of claim 24 ] 
comprising a plurality of clients outside an intranet; 

a first metrics server inside the intranet coupled to the 
plurality of clients and configured to non- intrusively measure network 
traffic being transferred in and out of the intranet and to generate 
performance metrics based on the network traffic measured; 

wherein the network traffic measured by the first metrics server 
includes packets being transferred for at least one first connection, 
the at least one first connection being a logical path from the first 
metrics server to one of the plurality of clients outside the 
intranet ; 

wherein the performance metrics generated by the first metrics 
server is for a predetermined measurement time interval using the 
measured network traffic for the at least one first connection; 
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a second metrics server that is configured to non- intrusively 
measure network traffic being transferred in and out of the intranet 
and to generate performance metrics based on the network traffic 
measured; 

wherein the network traffic measured by the second metrics server 
includes packets being transferred for at least one second connection, 
the at least one second connection being a logical path from the 
second metrics server to one of the plurality of clients outside the 
intranet ; 

wherein the performance metrics generated by the second metrics 
server is for a predetermined measurement time interval using the 
measured network traffic for the at least one second connection; 

wherein the first metrics server distributes performance metrics 
generated by the first metrics server to the second metrics server in 
the intranet; 

wherein the second metrics server distributes performance metrics 
generated by the second metrics server to the first metrics server in 
the intranet; and 

wherein the distributed performance metrics includes only the 
performance metrics generated by the first metrics server and the 
second metrics server that are different from any previously 
distributed performance metrics by the first metrics server and the 
second metrics server. 



27. (Amended) [The] A measurement infrastructure [ of claim 2G ] 
comprising : 

a plurality of clients outside an intranet; 

a first metrics server inside the intranet coupled to the 
plurality of clients and configured to non-intrusively measure network 
traffic being transferred in and out of the intranet and to generate 
performance metrics based on the network traffic measured; 
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wherein the network traffic measured by the first metrics server 
includes packets being transferred for at least one first connection, 
the at least one first connection being a logical path from the first 
metrics server to one of the plurality of clients outside the 
intranet ; 

wherein the performance metrics generated by the first metrics 
server is for a predetermined measurement time interval using the 
measured network traffic for the at least one first connection; 

a second metrics server that is configured to non- intrusively 
measure network traffic being transferred in and out of the intranet 
and to generate performance metrics based on the network traffic 
measured; 

wherein the network traffic measured by the second metrics server 
includes packets being transferred for at least one second connection, 
the at least one second connection being a logical path from the 
second metrics server to one of the plurality of clients outside the 
intranet ; 

wherein the performance metrics generated by the second metrics 
server is for a predetermined measurement time interval using the 
measured network traffic for the at least one second connection; 

wherein the first metrics server distributes performance metrics 
generated by the first metrics server to the second metrics server in 
the intranet ; 

wherein the second metrics server distributes performance metrics 
generated by the second metrics server to the first metrics server in 
the intranet ; 

wherein the performance metrics generated by the first and second 
metrics servers are distributed on a predetermined periodic basis; and 

wherein the predetermined periodic basis is one minute after 
performance metrics have been generated by the first and second 
metrics servers. 
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28. (Amended) A method of providing network performance metrics 
using an intranet, the intranet having at least one server, the method 
comprising : 

non- intrusively measuring network traffic between at least one 
server in an intranet and at least one client outside the intranet^ 
the intranet being a network accessible only by authorized users; and 

generating performance metrics from the network traffic measured 
between the at least one server and the at least one client within a 
predetermined measurement time interval. 

34. (Amended) A method of providing network performance metrics 
using an intranet, the intranet having at least one server, the method 
comprising : 

non- intrusively measuring network traffic for at least one 
connection, the at least one connection being a logical path between 
at least one server inside an intranet and at least one client outside 
the intranet , the intranet being a network accessible by authorized 
users ; 

generating performance metrics from the network traffic measured 
based on the at least one connection within a predetermined 
measurement time interval; and 

accumulating the generated performance metrics for the at least 
one connection that remains active beyond the predetermined 
measurement time interval. 

37. (Amended) A method of providing network performance metrics 
using an intranet, the intranet having at least one server, the method 
comprising: 

examining packets being transferred during a plurality of 
connections, such that each connection of the plurality of connections 
is a logical path between at least one server in the intranet and at 
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least one client outside the intranet / the intranet being a network 
accessible by authorized users ; 

generating performance metrics from the examined packets for the 
plurality of connections upon the expiration of a predetermined 
measurement time interval; 

accumulating performance metrics from the generated performance 
metrics for the plurality of connections for each of the plurality 
of connections that remain active beyond the predetermined measurement 
time interval; 

creating a record for each connection of the plurality of 
connections that are active during a predetermined measurement time 
interval; and 

deleting each created record corresponding to each connection of 
the plurality of connections that becomes inactive when [ beyond ] the 
predetermined measurement time interval expires , 
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